Ask HN: The government of my country blocked VPN access. What should I use?
616 rickybule 366 8/28/2025, 4:43:05 PM
Indonesia is currently in chaos. Earlier today, the government blocked access to Twitter & Discord knowing news spread mainly through those channels. Usually we can use Cloudflare's WARP to avoid it, but just today they blocked the access as well. What alternative should we use?
- First things first, you have to get your hands on actual VPN software and configs. Many providers who are aware of VPN censorship and cater to these locales distribute their VPNs through hard-to-block channels and in obfuscated packages. S3 is a popular option but by no means the only one, and some VPN providers partner with local orgs who can figure out the safest and most efficient ways to distribute a VPN package in countries at risk of censorship or undergoing censorship.
- Once you've got the software, you should try to use it with an obfuscation layer.
Obfs4proxy is a popular tool here, and relies on a pre-shared key to make traffic look like nothing special. IIRC it also hides the VPN handshake. This isn't a perfectly secure model, but it's good enough to defeat most DPI setups.
Another option is Shapeshifter, from Operator (https://github.com/OperatorFoundation). Or, in general, anything that uses pluggable transports. While it's a niche technology, it's quite useful in your case.
In both cases, the VPN provider must provide support for these protocols.
- The toughest step long term is not getting caught using a VPN. By its nature, long-term statistical analysis will often reveal a VPN connection regardless of obfuscation and masking (and this approach can be cheaper to support than DPI by a state actor). I don't know the situation on the ground in Indonesia, so I won't speculate about what the best way to avoid this would be, long-term.
I will endorse Mullvad as a trustworthy and technically competent VPN provider in this niche (n.b., I do not work for them, nor have I worked for them; they were a competitor to my employer and we always respected their approach to the space).
It would be nice if one of the big shortwave operators could datacast these packages to the world as a public service.
Seems like it was used way back in the cold war (and even then not blocked/jammed) and I'd guess that current authoritarian regimes would perhaps not bother considering how few could use it.
Has any government ever done that? Seems like it would just break everything (because the world is full of devices that use custom protocols!) at great computational expense.
It's clever. It tries to defeat attacks against one of the tougher parts of VPN connections to reliably obfuscate, and the effort's commendable, but I'll stop short of saying it's a good solution for one big reason: with VPNs and censorship circumvention, the data often speaks for itself.
A VPN provider working in this space will often have aggregate (and obviously anonymized, if they're working in good faith) stats about success rates and failure classes encountered from clients connecting to their nodes. Where I worked, we didn't publish this information. I'm not sure where Mullvad stands on this right now.
In any case -- some VPN providers deploying new technology like this will partner with the research community (because there's a small, but passionate formal research community in this space!) and publish papers, studies, and other digests of their findings. Keep an eye out for this sort of stuff. UMD's Breakerspace in the US in particular had some extremely clever people working on this stuff when I was involved in the industry.
Get your own VPS server (VPS in EU/US with 2GB of ram, 40GB of disk space and TBs/month of traffic go for $10 a year, it's that cheap). Never get anything in the UK and even USA is weird. I'd stick with EU.
Install your software (wireguard + obsfuscation or even tailscale with your own DERP server)
Another simpler alternative is just `ssh -D port` and use it as a SOCKS server. It's usually not blocked but very obvious.
Another method that usually worked was ProtonVPN with protocol set to Wireguard. Not sure why this worked, it’s definitely a lot more detectable than other methods I tried. But as long as I rotated which US server I used every few days, this worked fine.
No luck with shadowsocks, ProtonVPN “stealth” mode, Outline+Digital Ocean, or even Jump / Remote Desktop. Jump worked the longest at several hours before it became unbearably slow, I’m still not sure if I was actually throttled or my home computer started misbehaving.
I didn’t get around to setting up a pure TLS proxy, or proxying traffic through a domain that serves “legitimate” traffic, so no idea if that still works.
While access to plaintext is useful, it's not required for other rules which are eg looking at the timing and frequency of packets.
The main one is called an Eclipse Attack in cyber circles, and it can be done at any entity operating at the ASN layer so long as they can position themselves to relay your traffic.
The adversary can invisibly (to victim PoV) modify traffic if they have a cooperating rootPKI cert (anywhere in the ecosystem) that isn't the originating content provider, so long as they recognize the network signature (connection handshake); solely by terminating encryption early.
Without a cert, you can still listen in with traffic analysis, the fetched traffic that's already been encrypted with their key (bit for bit), as known plaintext the math quickly reduces. SNI and a few other artifacts referencing the resources/sites are not part of the encrypted payload.
Its more commonly known in a crypto context, but that kind of attack can happen anywhere. It even works against TOR. One of the first instances (afaik) was disclosed by Princeton researches in 2015, under the Raptor paper.
It's also probably more useful to just have a connection be fully dedicated to a VPN, and have the traffic volume over time mimic what you'd see in a video, rather than embedding it in a video -- thanks to letsencrypt, much of the web's served over TLS these days (asterisks for countries like KZ and TM which force the use of a state-sponsored CA), so going to great lengths to embed your VPN in a video isn't really practical.
- Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc). Bonus points if you can leverage something like ECH (ex-ESNI) to make it harder to identify a single bucket or subdomain.
- Keep spawning new domains and subdomains to distribute your binaries.
There are complications with both approaches. Some countries block ECH outright. Some have no problem shutting the internet down wholesale for a little bit. The domain-hopping approach presents challenges w/r/t establishing trust (though not insurmountable ones, much of the time).
These are thing that have to be judged and balanced on a case-by-case basis, and having partners on the ground in these places really helps reduce risk to users trying to connect from these places, but then you have to be very careful talking to then since they could themselves get in trouble for trying to organize a VPN distribution network with you. It's layers on layers, and at some point it helps to just have someone on the team with a background in working with people in vulnerable sectors and someone else from a global affairs and policy background to try and keep things as safe as they can be for people living under these regimes.
> - Host on a piece of infrastructure that's so big that you can't effectively block it without causing a major internet outage (think: S3, Cloudflare R2, etc).
How can one bounce VPN traffic through S3? Or are you just talking about hosting client software, ingress IP address lists, etc?
There are some more niche techniques that are _really_ cool but haven't gained widespread adoption, too, like refractive routing. The logistics of getting that working are particularly challenging since you need a willing partner who'll undermine some of their trustworthiness with some actors to support (what is, normally, to them) your project.
Of course, https://xkcd.com/538/ applies in full force, and I don't have any background in the space to make this a recommendation!
https://xeiaso.net/blog/anything-message-queue/
Your solution could technically work over any kind of open connection / data transfer protocol that isn't blocked by the provider but it would be an absolute pain to browse the web that way and there are probably better solutions out there.
Prior to this, pre-Covid I used to use shadowsocks hosted on a DO droplet. Shadowsocks with obfs, or a newer equivalent (v2ray w/ vmess or vless protocol) and obfs (reality seems to be the current hotness) will probably work within Indonesia given their blocking will be way less sophisticated than China. The difference here is that it’s a proxy, not a VPN, but it makes it a lot easier to obfuscate its true nature than a VPN which stands out because obfuscation isn’t in its design.
Hosting on big public VPSs can be double edged. On one hand, blocking DO or AWS is huge collateral. On the other, it’s an obvious VPN endpoint and can help identify the type of traffic as something to block.
If you have access to reddit, r/dumbclub (believe it or not) has some relatively current info but it’s pretty poor signal to noise. Scratch around there for some leads though.
Note that this stuff is all brittle as hell to set up and I usually have a nightmarish time duct-taping it all together. That’s why I’m overjoyed my WireGuard tunnel has worked whenever I’ve visited for a year now.
One other left-field option, depending on your cost appetite, is a roaming SIM. Roaming by design tunnels all data back to your own ISP before routing out so even in China roaming SIMs aren’t blocked. It’s a very handy backup if you need a clear link to ssh into a box to set up the above, for example.
What I settled on for decent reliability and speeds was a free-tier EC2 hosted in an international region. I then setup a SOCKS5 server and connected my devices to it. You mentioned Cloudflare so whatever their VM service is might also work.
It's very low profile as it's just your traffic and the state can't easily differentiate your host from the millions of others in that cloud region.
LPT for surviving the unfree internet: GitHub won't be blocked and you'll find all the resources and downloads you need for this method and others posted by Chinese engineers.
Edit: If you're worried about being too identifiable because of your static IP, well it's just a computer, you can use a VPN on there too if you want to!
Like others commented in this thread, having an obfuscator is a good idea to ensure the traffic is not dropped by DPI.
When the inevitable ban comes and your VPN stops working, rotate the IP of the external VPN and update the firewall/socat config to reflect it. Usually, the internal VM's IP doesn't need to be updated.
Could HK work?
Stepping back and looking at it from a purely technical perspective, it's actually insanely impressive.
Here's a USENIX paper from a few years ago on how it is done: https://gfw.report/publications/usenixsecurity23/en/
> the focus in this document is to enhance IP Traffic Flow Security (IP-TFS) by adding Traffic Flow Confidentiality (TFC) to encrypted IP-encapsulated traffic. TFC is provided by obscuring the size and frequency of IP traffic using a fixed-size, constant-send-rate IPsec tunnel
(If they block a constant rate stream, that'll hit a whole ton of audio/video streaming setups)
Really? Because the paper you linked says they don't block any TLS connections so you can just run a VPN over TLS:
> TLS connections start with a TLS Client Hello message, and the first three bytes of this message cause the GFW to exempt the connection from blocking.
What if you run your own HTTPS server that look semi-legitimate and just encapsulate it in that traffic?
Can they still detect it?
What about a VPS in HK? Is this even doable?
Why they chose this I have no idea.
You can even port share.
443 -> Web server for HTTPS traffic 443 -> OpenVPN for OpenVPN traffic
Still trivial to identify and not uncommon for even public WiFi to do so.
Since I changed to tailscale+headscale with my own derp server all these issues have disappeared (for now).
Also for your unability to access the VPN, as far as my experience goes, in the past some providers do block access to VPN. But, I am not experiencing that for at least the last 5 years.
So, maybe you can try changing your internet provider and see if you can connect to VPN?
Just look for any VPNs that are advertised specifically for China, Russia, or Iran. These are the cutting edge tech, they may not be so privacy-friendly as Mullvad, but they will certainly work.
If I was working for a secret service for these countries, I would set up many "VPNs that are advertised specifically for x" as honeypots to gather data about any dissidents.
VLESS / v2ray works in Russia, as far as I know.
No comments yet
[0]: https://www.inc.com/jennifer-conrad/the-fbi-created-its-own-...
I hope I do not present the presence of a dullard unfamiliar with this.
For an example of a proxy service https://www.digitalocean.com/community/tutorials/how-to-set-...
That will give you a hard to snoop proxy service that should completely circumvent a government blockaid (they likely aren't going to be watching or blocking ssh traffic).
1. They are in most cases run by national spy agencies.
2. They will at least appear to work, i.e., they will provide you with access to websites that are blocked by the country you are in. Depending on which country's spies run the system, they may actually work in the sense of hiding your traffic from that country's spies, or they may mark you as a specific target and save all your traffic for later analysis.
My inclination is to prefer free (open-source) software that isn't controlled by a company which can use that control against its users.
First, you use well-known cloud or dedicated hoster. All your traffic is now tied to the single IP address of that hoster. It may be linked to you by visiting two different sites from the same IP address. Furthermore, this hoster is legally required to do anything with your VPN machine on demand of corresponding state actors (this is not a speculative scenario; i. e. Linode literally silently MitMed one of their customers on German request). Going ever further, residential and company IPs have quite different rules when it comes to law enforcement. Seeding Linux ISOs from your residential IP will be overlooked almost everywhere (sorry, Germany again), but seeding Linux ISOs from AWS can easily be a criminal offense.
Second, you use some shady abuse-proof hosting company, which keeps no logs (or at least says that) and accepts payments in XMR. Now you're logging in to your bank account from an IP address that is used to seedbox pirate content or something even more illegal, and you still don't know if anyone meddles with your VPN instance looking for crypto wallet keys in your traffic.
VPN services have a lot of "good" customers for a small amount of IP addresses, so even if they have some "bad" actors, their IPs as a whole remain "good enough". And, as the number of customers is big, each IP cannot be reliably tied to a specific customer without access logs.
Kape Technologies Owns: ExpressVPN, CyberGhost, Private Internet Access, Zenmate
> is there any suspicion that Kape Technologies is influenced or has ties to the Mossad?
Yes, there is significant suspicion and public discussion about Kape Technologies having ties to former Israeli intelligence personnel. While a direct operational link to Mossad has not been proven, the concerns stem from the company's history, its key figures, and their backgrounds.
...
Kape Technologies is owned by Israeli billionaire Teddy Sagi. While Sagi himself does not have a documented intelligence background, his business history, which includes a conviction for insider trading in the 1990s, has been a point of concern for some privacy advocates. The consolidation of several major VPN providers under his ownership has raised questions about the potential for centralized data access.
----
Sure there isn't direct proof but there wasn't any proof the CIA was driving drug trade while it was happening. Proof materializes when the dust settles on such matters.
To be a little trite: we all agree that chickens like grain, but it does not follow that a majority of grain producers are secretly controlled by a cabal of poultry.
So the solution is no-name providers using random ad-hoc hackery, chosen according to a criterion more or less custom designed to lead you into watering hole attacks.
Right.
1) The problem is very difficult and requires a lot of engineering resources 2) It's very hard to make money in these countries for many reasons, including sanctions or the government restricting payments (Alipay, WeChatPay, etc)
The immediate response would be: "If the problem is so difficult, how can it be solved if not be well-known, well-established providers?"
The answer is simple: the crowdsourcing power of open source combined with billions of people with a huge incentive to get around government blocking.
Tor and I2P, for example, don't actually make money anywhere. Which is not to say that they work for any of the users in all of these places, or for all of the users in any of these places.
> The answer is simple: the crowdsourcing power of open source combined with billions of people with a huge incentive to get around government blocking.
The actual answer is that (a) they're using so many different weird approaches that the censors and/or secret police can't easily keep up with the whack-a-mole, and (b) they're relying on folklore and survivorship bias to tell them what "works", without really knowing when or how it might fail, or even whether it's already failing.
Oh, and most of them are playing for the limited stakes of being blocked, rather than for the larger stakes of being arrested. Or at least they think they are.
Maybe that's "solving" it, maybe not.
Perhaps you should stop and think about why people living in countries where governments actually censor a lot hardly use these "well-established providers" to circumvent censorship. Tip: it's not because they're stupid.
Yeah, maybe V* and derivatives are random ad-hoc hackery, but they also are the well-known standard now.
A lot of people use Telegram and think it's private, too.
What about the part about choosing your VPN provider in the way most likely to get you an untrustworthy one who's after you personally?
[1] https://psiphon.ca/ [2] https://github.com/Psiphon-Inc
On the one hand they do DPI with ML.
On the other hand a major player is open!
Something is not right here...
edit: op, protonvpn has a free tier that works in russia, so likely works everywhere, or if you're comfortable with buying a vps, sshing into it and running some commands, look up x-ray, and use on of their gui panels
What you need is open protocols and hundreds of thousands of small servers only known to their owners and their family/friends
1: https://archive.is/sxiha
If you’re worried about ending up on a list, using things that look like VPNs while the VPNs are locked down is likely to do so.
Also… your neighbors in Myanmar didn’t do a lockdown during the genocide and things got pretty fucking dire as a result. People have taken different lessons from this. I’m not sure what the right answer is, and which is the greater evil. Deplatforming and arresting people for inciting riots and hate speech is probably the best you can do to maintain life and liberty for the most people.
The genocide in Myanmar was incited _by_ the government there; giving it more power to censor it's citizens' communications would have done absolutely nothing to help the people being genocided. Genocides don't just suddenly happen; the vast majority of genocide over the past century (including Indonesian genocides against ethnically Chinese Indonesians) had the support of the state.
At that time I think the government was hands off, let it happen rather than tried to stop it.
Regardless of who was behind the violence, the whole region has thought about what to do in such situations and they aren’t the same answers the West would choose.
https://old.reddit.com/r/dumbclub/
Something quite depressing is if we (HN crowd) find workarounds, most regular folks won't have the budget/expertise to do so, so citizen journalism will have been successfully muted by government / big media.
How about instead of being depressed you start being vocal and defiant?
Maybe The Guardian should open a branch in Sealand...
They would argue back on technical merits, I was talking political, a politics doesn't give a damn about the tech. We have slowly been going down this path for a while now.
“The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia,” - PM Malcolm Turnbull in 2017.
I grew up in a pretty deprived area of the UK, and we all knew "a guy" who could get you access to free cable, or shim your electric line to bypass the meter, or get you pirated CD's and VHS' and whatever.
There will always be "that guy down the pub" selling raspberry pi's with some deranged outdated firmware that runs a proxy for everything in the house or whatever. To be honest with you, I might end up being that guy for a bunch of people once I'm laid off from tech like the rest. :)
They can barely handle wolf-whistlers let alone pedophile rape gangs consisting of the lowest IQ dregs of our society.
I know it’s only painfully stupid people who think the law is stupid, but dodgy Dave down the way tends to fly under the radar. Otherwise there wouldn’t be so many of them.
The moment your dodgy Dave offends your local cadre, even for reasons entirely other than being dodgy, they'll throw the book at him. And because there is now unpredictability around who will be arrested and for what reason, it acts as a chilling effect for everyone who values some degree of stability in their lives. So the arc of dodgy Daves bends toward compliance.
Authoritarianism in the UK doesn't correlate with crime. The economy does.
The point of these things is not really to help citizens. "there's no money for that" like there's no money for healthcare or education (although there is for bombings in foreign countries). The point is protecting power from any threat that could mount against it.
Seeing companies like Palantir (and many lesser known ones) buddy up to everyone that wants it, its a clear statement on how they want to monitor and control the populace.
Long term I don't think it can be done, but the pain mid term can be vast.
You should be worried. Don't underestimate the capabilities of the government bureaucrats. That "guys down the pub" will quickly disappear once they start getting jail time for their activities.
They cannot enforce laws against such "petty" crimes, the reason society mostly functions in the UK is because most people don't try to break the law.
Pretty sure the local punters would kick the cops out if they came for one of their own, especially if he got them their porn back.
What makes you think, if the Gov was to implement some sophisticated DPI firewall that blocks a million different things, they won't come after the people who circumvent it? They already enforce petty crimes. I could report you for causing me anxiety and you would have a copper show up at your door.
There is no need for special efforts to enforce the law. Put a few people in jail - and everyone else will quickly find safer and more legal ways to spend their time. No one will do something like that unless they are confident of their impunity.
Somehow, things that could be unifying protests where the working class of every political stripe are able to overlook their differences and push back against government never seem to happen. It is always polarized so that it's only ever one side at a time, and the other side is against them. How does that work?
So as soon as Labour comes out for something, Cons are inclined to be against it and so on. The only way to have neutral protests is if no one visibly backs them and they don't become associated with a side, but then how do they get support and organization?
It will only work if they admit that they supported this and all forms of totalitarianism during COVID. You can't fall for that and then be surprised when the world keeps going down that obvious path.
The problem with covid is that we weren't totalitarian enough. Regulations you could drive a coach & horses through and no way to enforce is a sop.
The first lock down needed to be a proper 'papers, please' affair. When we get a properly lethal pandemic, we're fucked. Hopefully Laurence Fox and Piers Corbyn will catch it quickly and expire in a painful and televised way, it's the only hope of people complying with actual quarantine measures.
You're right. But compared to what?
I guess 99% of mainstream "journalism" is irrelevant and/or inaccurate, hence citizen journalism is a 10x improvement in accuracy and relevancy! Not 10% better, 900% better! This makes a huge difference to our society as a whole and in our daily lives!
But this misses the most important point which is that the user should have the right to choose for themselves what they say and read. Making citizen journalism unduly burdensome deprives everyone of that choice.
Those citizen journalists with their primary sources, disgusting.
Thats nothing but propaganda.
Remember it doesnt matter what the video shows, it only matters who showed it to you.
Both matter.
In an age of mass media (where there's a video for anything) or now one step further synthetic media knowing who makes something is much more important than the content, given that what's being shown can be created on demand. Propaganda in the modern world is taking something that actually happened, and then framing it as an authentic piece of information found "on the street", twisting its context.
"what's in the video" is now largely pointless, and anyone who isn't gullible will obviously always focus on where the promoter of any material wants to direct the audiences attention to, or what they want to deflect from.
Well you'd be surprised to find out that this stupid policy (and many more) have been brought forward by Labour (Left).
The goal right now is to make online anonymity impossible. Adult content is the wedge issue being used to make defending it unpalatable for any elected official, but nobody actually has it as a goal to prevent teenagers from looking at porn - if they did, they would be using more direct and efficient strategies. No, it's very clear that anonymous online commentary is hurting politicians and they are striking back against it.
They're being pushed by media conglomerates News Corp and Nine Entertainment [0] to crush competition (social media apps). With the soon-to-be-introduced 'internet licence' (euphemism: 'age verification'), and it's working. If they ban VPN's, it will make social media apps even more burdensome to access and use.
[0] News Corp and Nine Entertainment together own 90% of Australian print media, and are hugely influential in radio, digital and paid and free-to-air TV. They have a lot to gain by removing access to social media apps, where many (especially young) people get their information now days.
Yep, not a great time line here.
- Tailscale with Mullvad exit nodes. Pros: little setup but not more than installing and configuring a program, faster than Got, very versatile. Cons: deep packet inspection can probably identify your traffic is using Mullvad, costs some money.
- Your own VPSs with Wireguard/Tailscale. Pros: max control, you control how fast you want it, you can share with people you care about (and are willing to support). Cons: the admin effort isn't huge but requires some skill, cost is flexible but probably 20-30$ per month minimum in hosting.
Tailscale is completely unnecessary here, unless OP can't connect to Mullvad.net in the first place to sign up. But if the Indonesian government blocks Mullvad nodes, they'll be out of luck either way.
> - Your own VPSs with Wireguard/Tailscale
Keep in mind that from the POV of any websites you visit, you will be easily identifiable due to your static IP.
My suggestion would be to rent a VPS outside Indonesia, set up Mullvad or Tor on the VPS and route all traffic through that VPS (and thereby through Mullvad/Tor). The fastest way to set up the latter across devices is probably to use the VPS as Tailscale exit node.
Typo? Wireguard-capable VPSes are available for $20-$30 per year. (https://vpspricetracker.com/ is a good site for finding them.)
Stay safe
Outline (shadowsocks-based) and amnezia (obfuscated wg and xray) both offer few-click install on your own VPS, which is easier than setting up headscale or static wg infrastructure, and will last you longer.
Also, you did not answer my "why" question. I'm not sure what question you were answering.
$4/month VPS from DigitalOcean is more than enough to handle a few users as per my experience. I have a Wireguard setup like this for more than a year. Didn't notice any issues.
It's the first time I've encountered where the entire protocol is just blocked. Worth checking what is blocked and how before deciding which VPN provider to use.
https://github.com/erebe/wstunnel
There are some solutions that mimic the traffic and, say, route it through 443/TCP.
We lived through the golden age of the Internet where anyone was allowed to open a raw socket connection to anyone else, anywhere. That age is fading, now, and time may come where even sending an email to someone in Russia or China will be fraught with difficulty. Certainly encryption will be blocked.
We're going to need steganographic tech that uses AI-hallucinated content as a carrier, or something.
Honestly this is the route I'm sure the UK will decide upon in the not too distant future.
The job of us hackers is going to become even more important...
Wireguard is indeed blocked.
how does it differ from regular TLS 1.3 traffic?
The tunnel itself is encrypted, but the tunnel creation and existence is not obfuscated.
https://joinmastodon.org/
Advanced VPN tunneling protocols, for example, have to take a lot of special measures to conceal their nature from China's and Russia's deep packet inspecting firewalls.
I've used this on multiple trips to China over the past decade (including a trip last year). You can find carriers that will charge very low (or even no) roaming rates.
Chinese forums / blogs have a lot of information about this stuff. I usually ask ChatGPT to translate "Research topic re: some form of circumvention and give me forum posts and blog posts about it" to Chinese, then paste that into DeepSeek with search enabled and just let Chrome translate the responses. Does a really good job. At least better than what I can manage with Baidu.
I followed [1] to set up my own proxy, which works pretty fine. More config examples may be helpful, e.g. [2].
[1]: https://cscot.pages.dev/2023/03/02/Xray-REALITY-tutorial/
[2]: https://github.com/XTLS/Xray-examples/blob/main/VLESS-TCP-XT...
My use case consists of passing some apps on my Android through interface A (e.g. banking apps through my 5G modem), some apps through US residential proxy (for US banks that don't like me visiting from abroad), and all the rest through VPN. And no root required!
It's wild that GFW triggered creation of this and nothing like it existed / exists.
[1]: https://github.com/SagerNet/sing-box
Such coincidence might seems like the government trying to do some damage control by restricting internet access, but I hope that's not what happen here. At the moment, cloudflare status for Jakarta is still "rerouted".
[1] https://www.cloudflarestatus.com/incidents/1chpg2514kq8
[2] https://www.youtube.com/watch?v=-jONV0mb9nw
Technical details: https://obscura.net/blog/bootstrapping-trust/
Let us know what you think!
Disclaimer: I'm the creator of Obscura.
You are making some bold claims but without the source I can't verify those claims.
Any plans to open-source it?
Here it is: https://github.com/Sovereign-Engineering/obscuravpn-client
Another obfuscated solution is Amnezia
If you are not ready to set up your own VPN server and need any kind of connection right now, try Psiphon, but it's a proprietary centralized service and it's not the best solution.
Countries like China have blocked SSH-based tunneling for years.
It can also block sessions based on packet sizes: a typical web browsing session involves a short HTTP request and a long HTTP response, during which the receiving end sends TCP ACKs; but if the traffic traffic mimics the above except these "ACKs" are a few dozen bytes larger than a real ACK, it knows you are tunneling over a different protocol. This is how it detects the vast majority of VPNs.
Details are not at the top of my mind these years later, but you can probably rig something up yourself that looks like regular web dev shit and not a known commercial VPN. I think there was a preference in Firefox or something.
Source: used to work for a shady SEO company that searched Google 6,000,000 times a day on a huge farm of IPs from every provider we could find
Go on https://lowendbox.com and get a cheap cheap cheap VPS. Use ssh SOCKS proxy in your browser to send web traffic through it.
Very unfancy, a 30+ year old solution, but uses such primitive internet basics that it will almost certainly never fail. Builtin to everything but Windows (which afaik doesn't have an ssh client built-in).
Tailscale is also super fantastic.
It already fails in China and Russia. Simply tunneling HTTP through SSH is too easy to detect with DPI.
> Windows (which afaik doesn't have an ssh client built-in)
It has had both SSH client and SSH server built-in since Win10.
It’s a nice technical question on how to run a VPN but the ultimate goal is not the best technical solution but the ability to avoid detection by the state. And that’s not a technical problem but an opsec one
If someone is participating in online discussions (discord and twitter) to spread local news - then it’s hard to know who is who, and who to trust - and that’s kind of the why Arab spring did not spring “hey wear a red carnation and meet me by the corner” can become a death sentence
The answer to opsec is avoid all digital comms - but at this point you are seriously into “regieme change”, or just as Eastern Europe did, keep your heads down for forty years and hope those who leave you economically behind will half bankrupt them selves bringing you back.
I think in the end, a thriving middle class with a sufficient amount of land reform, wealth taxes which can over a generation push for liberalisation sounds a good idea.
Our job in the very lucky liberal West is to keep what our forefathers won, and then push it further to show why our values are worth the sacrifice in copying
https://www.reddit.com/r/Tailscale/comments/16zfag4/travelin...
Some good ideas, though. There seems to be OSS alternatives for TailScale control servers which would make it harder to block - I'd go that route. The top recommendation boils down to, "Set up several different methods, and one will always work".
https://github.com/amnezia-vpn/amneziawg-go https://github.com/wgtunnel/wgtunnel
https://old-reddit-com.translate.goog/r/WkwkwkLand/comments/...
Cloudflare says some issue affecting Jakarta has been resolved. They aren't saying what the issue was.
https://www.cloudflarestatus.com/incidents/1chpg2514kq8
I can't imagine those who are caught in the chaos with only their phone and unable to access information that could help them to be safe.
Esimdb is a good place to start.
To use them, one need to first rent a (virtual) server somewhere from a foreign cloud provider as long as the payment does not pose a problem. The first step sometimes proves difficult for people in China, but hopefully Indonesia is not at that stage yet. What follows is relatively easy as there are many tutorials for the deployment like: https://guide.v2fly.org/en_US/
https://www.theguardian.com/world/2025/aug/26/indonesia-prot...
Sorry I don't have a better freely accessible source, maybe someone with more knowledge can fill it in.
I'm almost positive that everyone in the US Congress is making at least ten times the minimum wage in this country. The "housing allowance" being referred to is separate from their normal salary in Indonesia, but still, interesting to imagine how much more seriously people there would take that disparity than in many other countries.
This caught my attention more:
> Indonesia passed a law in March allowing for the military to assume more civilian posts, while this month the government announced 100 new military battalions that will be trained in agriculture and animal husbandry. In July the government said the military would also start manufacturing pharmaceuticals.
They're replacing civilian industry with military, apparently not out of any emergency requirement but just to benefit the military with jobs (and the government with control over those sectors) at the expense of civilian jobs.
https://www.theguardian.com/world/2025/aug/26/indonesia-prot...
So well, my guess is they're trying to control it.
Since you get to pick where the hardware is located and it is just you (or you and a small group of friends & family) using the VPN, blocking is more difficult.
If you don't want the hassle of using your own hardware you can rent a Digital Ocean droplet for <$5 per month.
https://getoutline.org/
It seems to me that using WireGuard (UDP) in conjunction with something like Raptor Forward Error Correction would be somewhat difficult to block. A client could send to and receive from a wide array of endpoints without ever establishing a session and communicate privately and reliably, is that correct?
I found this article [0] summarizing the history of censorship and anti-censorship measures in China, and I think it might be of help to you if the national censorship ever gets worse. As is shown in the article, access blocking in China can be categorized into several kinds: (sorted by severity)
1. DNS poisoning by intercepting DNS traffic. This can be easily mitigated by using a DOT/DOH DNS resolver.
2. Keyword-based HTTP traffic resetting. You are safe as long as you use HTTPS.
3. IP blocking/unencrypted SNI header checking. This will require the use of a VPN/proxy.
4. VPN blocking by recognizing traffic signatures. (VPNs with identifiable signatures include OpenVPN and WireGuard (and Tor and SSH forwards if you count those as VPNs), or basically any VPN that was designed without obfuscation in mind.) This really levels up the blocking: if the government don't block VPN access, then maybe any VPN provider will do; but if they do, you will have a harder time finding providers and configuring things.
5. Many other ways to detect and block obfuscated proxy traffic. It is the worse (that I'm aware of), but it will also cost the government a lot to pull off, so you probably don't need to worry about this. But if you do, maybe check out V2Ray, XRay, Trojan, Hysteria, NaiveProxy and many other obfuscated proxies.
But anyways, bypassing techniques always coevolve with the blocking measures. And many suggestions here by non-Indonesian (including mine!) might not be of help. My personal suggestion is to find a local tech community and see what techniques they are using, which could suit you better.
[0] https://danglingpointer.fun/posts/GFWHistory
Is there any good DoT/DoH DNS resolver that works well in China? I know I can build one myself, but forwarding all DNS requests to my home server in NA slows down all connections...
Though if Indonesia has blocked VPNs only now, possibly they only block major providers and don't try to detect the VPN protocol itself, which would make self-hosting any VPN possible.
Why is Indonesia in chaos?
I was wondering that too, looks like https://en.wikipedia.org/wiki/2025_Indonesian_protests.
We tried things like Proton VPN and Windscribe VPN, as well as enabling MT proxy on Telegram, but soon govts find it easier to just mass ban internet access.
Use Netblocks.org to analyse the level of internet blockage and try to react accordingly.
Very helpful community.
https://amnezia.org/
Using full-blown VPNs under such environments has the disadvantage of affecting your use of domestic web services. You might want to try something like https://github.com/database64128/shadowsocks-go, which allows you to route traffic based on domain and IP geolocation rules.
It's a mixed bag apparently, free press is technically legal since 1998 but selective prosecution and harassment of those actually uncovering issues (mainly becomes clear in the last section, "Safety")
Tried looking up Serbia next on that website but got a cloudflare block. I'm a robot now...
Think about it Aachen. If the government has enough power to censor internet traffic, that what was the first thing it censored? Which media is traditionally known for being censored or just speaking propaganda? That's the classical newspapers. It's not uncommon in authoritarian countries for editors to need state to sign off on the day's paper. And if not that, articles are signed and publishers are known. They will auto-censor to avoid problems. Just like creators on YouTube don't comment on this one country's treatment of civilians to avoid problems.
AWS ap-southeast-3 should still be up, and isn't in a different partition like CN, govcloud, iso etc. So a VM there and a vpc peer in the US should get you around a lot of stuff.
Yes, it's hard work. Yes, it will take a long time. Yes, you personally may not get very far with your efforts.
But if Indonesians don't take responsibility for and work to improve Indonesia then the rest of it doesn't matter.
There are no technical solutions to what is fundamentally a problem of political culture.
Step 1 is establishing a secure means of communication.
i.e. One is better off tunneling over https://www.praise-the-glorious-leader.google.com.facebook.c...
include SSH traffic protocol auto-swapping on your server (i.e. no way to tell the apparent web page differs between clients), as some corporate networks are infamously invasive. People can do this all day long, and they do... =3
At least it isn't goatse...
The point was to include something clowns can't filter without incurring collateral costs, and wrapping the ssh protocol in standard web traffic. =3
This gets you a temporarily usable system and if you can tunnel this way successfully installing some WireGuard or OpenVPN stuff will likely work.
EDIT: Thanks it's -D not -R
Sorry for the brain rot!
Hope it helps!
What with certain countries (they know who they are) and their hatred for encryption, it got me wondering how people would communicate securely if - for example - Signal/WhatsApp/etc. pulled out and the country wound up disconnecting the submarine cables to "keep $MORAL_PANIC_OF_THE_DAY safe."
How would people communicate securely and privately in a domestic situation like that?
At that point you've essentially lost.
You either hope another country sees value in spreading you some democracy, or you rise up and hope others join you.
Or not and you accept the protection the state is graciously providing to you.
Prepare to fill in Cloudflare captchas all day, but that's what it takes to have a bit of privacy nowadays.
You could also buy a VPS and use SSH tunneling to access a tor daemon running on a VPS. Host some sort of web service on the VPS so it looks inconspicuous
No comments yet
Other than that: tor
No comments yet
Nonetheless this is a surprisingly simple and bullet proof solution: SSH, that's not vpn boss, i need it for work.
https://github.com/Jigsaw-Code/outline-apps
Android & iOS & Linux & Mac & Windows
their server installer will help set up a proxy for users that aren't familiar with shadowsocks, too
It worked well for me in UAE when other solutions didn’t
Not every website will allow it, but it should get you access to more than you have now.
Then, setup Tailscale on the server. You can VPN into it and essentially browse the internet as someone from NA.
Obviously I have 0 real experience with this.
It should also be possible to use a tunnel to get around the blocking of WireGuard, for example.
You can then use it as an exit node if needed. It should work in theory, I have never tried this though. I just speak as a very frequent user of Tailscale with a bunch of nodes that are geographically located in different cities around me.
There are 2 paths you can take here:
1. Roll your own VPN server on a VPS at a less common cloud provider and use it. If you're tech savvy and know what you're doing, you can get this going in <1hr. Be mindful of the downsides of being the sole user of your custom VPN server you pay for: cloud providers log all TCP flows and traffic correlation is trivial. You do something "bad", your gov subpoenas the provider who hands over your personal info. If you used fake info, your TCP flows are still there, which means your ISP's IP is logged, and deanonymizing you after that is a piece of cake (no court order needed in many countries).
2. Get a paid commercial VPN service that values your privacy, has a diverse network of endpoints and protocols. Do not use any random free VPN apps from the Play/App stores, as they're either Chinese honeypots (https://www.bitdefender.com/en-us/blog/hotforsecurity/china-...) or total scams (https://www.tomsguide.com/computing/vpns/this-shady-vpn-has-...).
Do not go with a VPN service that is "mainstream" (advertised by a Youtuber) or one that has an affiliate program. Doing/having both of these things essentially requires a provider to resort so dishonest billing practices where your subscription renews at 2-5x of the original price. This is because VPNs that advertise or run affiliate programs don't make a profit on the initial purchase for that amazing deal thats 27 months with 4 months free or whatever the random numbers are, they pay all of this to an affiliate, sometimes more. Since commercial VPNs are not charities, they need ROI and that comes only when someone rebills. Since many people cancel their subscriptions immediately after purchase (to avoid the thing that follows) the rebill price is usually significantly more than the initial "amazing deal". This is why both Nord and Express have multiple class action lawsuits for dishonest billing practices - they have to do it, to get their bag (back). It's a race to the bottom of who can offer the most $ to affiliates, and shaft their customers as the inevitable result.
Billing quirks aside, a VPN you choose should offer multiple VPN protocols, and obfuscation techniques. There is no 1 magic protocol that just works everywhere, as every country does censorship differently, using different tools.
- Some do basic DNS filtering, in which case you don't need a VPN at all, just use an encrypted DNS protocol like DOH, from any provider (Cloudflare, Google, Control D[I also run this company], NextDNS, Adguard DNS)
- Then there is SNI filtering, where changing your DNS provider won't have any effect and you will have to use a VPN or a secure proxy (HTTPS forward proxy, or something fancier like shadowsocks or v2ray).
- Finally there is full protocol aware DPI that can be implemented with various degrees of aggressiveness that will perform all kinds of unholy traffic inspection on all TCP and UDP flows, for some or all IP subnets.
For this last type, having a variety of protocols and endpoints you can connect to is what's gonna define your chance of success to bypass restrictions. Beyond variety of protocols, some VPN providers (like Windscribe, and Mullvad) will mess with packets in order to bypass DPI engines, which works with variable degree of success and is very region/ISP specific. You can learn about some of these concepts in this very handy project: https://github.com/ValdikSS/GoodbyeDPI (we borrow some concepts from here, and have a few of our own).
Soooo... what are good VPNs that don't do shady stuff, keeps your privacy in mind, have a reasonably sized server footprint and have features that go beyond basic traffic proxying? There is IVPN, Mullvad, and maybe even Windscribe. All are audited, have open source clients and in case of Windscribe, also court proven to keep no logs (ask me about that 1 time I got criminally charged in Greece for actions of a Windscribe user).
If you have any questions, I'd be happy to answer them.
If so, then you have a VPN.
https://www.boycat.io/vpn
Don't know if it will help in this situation as it's designed to be a VPN not controlled by Israel, but it might be worth a try.
The "shoulda done..." advice isn't useful in the slightest, and I'd argue is malicious with how often it's done simply to satiate a poster's ego.
Uses TCP and works pretty much anywhere.
https://www.boycat.io/vpn
That’s basically undetectable. Long lived ssh connection? Totally normal. Lots of throughput? Also normal. Bursts throughput? Same.
Not sure how to do this on mobile.
Tailscale might be an option too (they have a free account for individuals and an exit node out of country nearly bypasses your problem) It uses wireguard which might not be blocked and which comes with some plausible deniability. It’s a secure network overlay not a VPN. It just connects my machines, honest officer.
One way they tend to "solve" workarounds is making examples of people
https://www.stunnel.org/index.html
https://github.com/yarrick/iodine
https://infocondb.org/con/black-hat/black-hat-usa-2010/psudp...
..and many many more, as networks see reduced throughput as an error to naturally route around. =3
This is a good start but more should be blocked. Then force ISP to block ads.
Not just for Indonesia but all countries. But we still have a lot more to do to fix the web.